Carbon Black Cloud: Can the Sensor be installed in KEXT mode on Apple M1 Silicon?

[#1]

Environment

• Carbon Black Cloud Sensor: 3.5.1.19 and Higher
  • Audit & Remediation (was CB LiveOps)
  • Endpoint Standard (was CB Defense)
  • Enterprise EDR (was CB ThreatHunter)
• Apple macOS: Big Sur and Higher

Question

Can the Carbon Black Cloud (CBC) Sensor for macOS be installed in Kernel Extension (KEXT) mode on machines with the M1 chip?

Answer

Not currently, no.

Additional Notes

• From Release Notes for macOS

  Sensor release 3.5.1.19 introduces experimental support for the Apple Silicon M1 using the non-native, emulation mode.
  Native support for the Apple Silicon architecture will be available in a future release.

• The 3.5.1.19 Sensor must be run in Emulation and installed in System Extension (SysEXT) mode, and Kernel Extensions (KEXTs) are not supported on M1 in emulation
• Please see https://community.carbonblack.com/t5/Documentation-Downloads/Carbon-Black-Cloud-macOS-Big-Sur-Functi... for information on which functionality is supported for KEXT mode and SysEXT mode

Related Content

Carbon Black Cloud sensor: macOS support
https://developer.apple.com/documentation/apple_silicon/about_the_rosetta_translation_environment
[Carbon Black Cloud] macOS User Space Functionality Overview
Carbon Black Cloud: Is Apple M1 silicon supported?